mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Sean Young <sean@mess.org>
To: linux-media@vger.kernel.org, Sean Young <sean@mess.org>,
	Mauro Carvalho Chehab <mchehab@kernel.org>,
	Markus Elfring <elfring@users.sourceforge.net>
Cc: stable@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH v5 05/15] media: redrat3: Error path leaves device in transmitting state
Date: Wed, 29 Jul 2026 16:22:43 +0100	[thread overview]
Message-ID: <92bf1bf1bbdcac248de159a1670bb8bc1c7fab14.1785338381.git.sean@mess.org> (raw)
In-Reply-To: <cover.1785338381.git.sean@mess.org>

In the allocation failure error path, the transmitting boolean is not
cleared. If this error path is followed the transmitter cannot be
used again until the device is replugged or the module reloaded.

Fix the error path by moving the assignment statement.

Remove the check for the transmitting state in transmit, since rc-core
ensures there is never a reentrant call to the driver transmit function;
the transmit function is always called with dev->lock held.

The transmitting boolean is only used for interpretting firmware errors.

Fixes: fac59136bc22 ("[media] RedRat3: Return directly after a failed kcalloc() in redrat3_transmit_ir()")"
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
---
 drivers/media/rc/redrat3.c | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
index 994d4864520c..602b84dd628d 100644
--- a/drivers/media/rc/redrat3.c
+++ b/drivers/media/rc/redrat3.c
@@ -773,17 +773,9 @@ static int redrat3_transmit_ir(struct rc_dev *rcdev, unsigned *txbuf,
 	u8 curlencheck = 0;
 	unsigned i, sendbuf_len;
 
-	if (rr3->transmitting) {
-		dev_warn(dev, "%s: transmitter already in use\n", __func__);
-		return -EAGAIN;
-	}
-
 	if (count > RR3_MAX_SIG_SIZE - RR3_TX_TRAILER_LEN)
 		return -EINVAL;
 
-	/* rr3 will disable rc detector on transmit */
-	rr3->transmitting = true;
-
 	sample_lens = kzalloc_objs(*sample_lens, RR3_DRIVER_MAXLENS);
 	if (!sample_lens)
 		return -ENOMEM;
@@ -794,6 +786,9 @@ static int redrat3_transmit_ir(struct rc_dev *rcdev, unsigned *txbuf,
 		goto out;
 	}
 
+	/* rr3 will disable rc detector on transmit */
+	rr3->transmitting = true;
+
 	for (i = 0; i < count; i++) {
 		cur_sample_len = redrat3_us_to_len(txbuf[i]);
 		if (cur_sample_len > 0xffff) {
-- 
2.55.0


  parent reply	other threads:[~2026-07-29 15:23 UTC|newest]

Thread overview: 17+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <cover.1785338381.git.sean@mess.org>
2026-07-29 15:22 ` [PATCH v5 01/15] media: streamzap: Add missing rc_unregister_device() Sean Young
2026-07-29 15:22 ` [PATCH v5 02/15] media: redrat3: Ensure rc device is freed if enable_detector() fails Sean Young
2026-07-29 15:22 ` [PATCH v5 03/15] media: redrat3: Ensure we don't read beyond the end of the packet Sean Young
2026-07-29 15:22 ` [PATCH v5 04/15] media: redrat3: Ensure all urbs are suspended Sean Young
2026-07-29 15:22 ` Sean Young [this message]
2026-07-29 15:35   ` [PATCH v5 05/15] media: redrat3: Error path leaves device in transmitting state Markus Elfring
2026-07-30  5:17   ` Markus Elfring
2026-07-29 15:22 ` [PATCH v5 06/15] media: sunxi-cir: Ensure no more interrupts can occur before free Sean Young
2026-07-29 15:22 ` [PATCH v5 07/15] media: meson-ir-tx: Ensure clock is disabled on unbind Sean Young
2026-07-29 15:22 ` [PATCH v5 08/15] media: meson-ir-tx: Ensure rc_free_device() is called " Sean Young
2026-07-29 15:22 ` [PATCH v5 09/15] media: meson-ir-tx: Ensure probe error is propagated Sean Young
2026-07-29 15:22 ` [PATCH v5 10/15] media: ir-hix5hd2: Ensure rdev is setup before interrupts are enabled Sean Young
2026-07-29 15:22 ` [PATCH v5 11/15] media: cx88: Specify rc type at rc_allocate_type() Sean Young
2026-07-29 15:22 ` [PATCH v5 12/15] media: saa7134: " Sean Young
2026-07-29 15:22 ` [PATCH v5 13/15] media: rc: Fix race condition during rc_register_device() Sean Young
2026-07-29 15:22 ` [PATCH v5 14/15] media: rc: Use after free in ir_raw_event_handle() Sean Young
2026-07-29 15:22 ` [PATCH v5 15/15] media: rc: Fix use after free in bpf progs Sean Young

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=92bf1bf1bbdcac248de159a1670bb8bc1c7fab14.1785338381.git.sean@mess.org \
    --to=sean@mess.org \
    --cc=elfring@users.sourceforge.net \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-media@vger.kernel.org \
    --cc=mchehab@kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®